A 25-Year-Old Is Writing Backdoors Into The Treasury's $6 Trillion Payment System. What Could Possibly Go Wrong?

[mahatmakanejeeves]

A 25-Year-Old Is Writing Backdoors Into The Treasury’s $6 Trillion Payment System. What Could Possibly Go Wrong?

(Mis)Uses of Technology

from the let's-just-do-it-and-be-legends,-man dept
Wed, Feb 5th 2025 10:48am - Mike Masnick

Just months after we learned Chinese hackers had compromised US telecom systems through government-mandated backdoors, an inexperienced developer from Musk’s DOGE unit is pushing untested code directly into the Treasury’s payment infrastructure — a system that handles over $6 trillion in federal payments annually.

It seems reasonable to call it one of the most dangerous cyberattacks on the US government.

The Treasury Department wants us to believe everything is fine. When Senators Warren and Wyden — the ranking members of the Banking and Finance Committees — demanded answers about Musk’s team’s access to the payment system, Treasury responded with reassurances: just “read only” access, they claimed, with no ability to interfere with payments.

Importantly, the ongoing review of Treasury’s systems is not resulting in the suspension or rejection of any payment instructions submitted to Treasury by other federal agencies across the government. In particular, the review at the Fiscal Service has not caused payments for obligations such as Social Security and Medicare to be delayed or re-routed. To be clear, the agency responsible for making the payment always drives the payment process. Currently, Treasury staff members working with Tom Krause, a Treasury employee, will have read-only access to the coded data of the Fiscal Service’s payment systems in order to continue this operational efficiency assessment. This is similar to the kind of access that Treasury provides to individuals reviewing Treasury systems, such as auditors, and that follows practices associated with protecting the integrity of the systems and business processes.

But while Treasury was making these claims, both Wired and TPM revealed a far more alarming reality: a 25-year-old DOGE team member named Marko Elez (who had refused to give any of his brand new colleagues his last name) had been granted something far beyond “read only” access — he had full administrator privileges to the system. That’s the keys to the kingdom (or, rather, the kingdom’s payments):

{snip}

[Autumn]

1. He could empty out the treasury and leave the nation broke. I'm sure there

are places he could flee to and get away with it. It would serve the fucking Republicans right. I can't think of any other reason the would be snooping around.

[patphil]

2. I hope the Treasury Dept people have deep backups that predate the assault on their systems.

If we ever get out of this mess, we can restore the code to just before the Musk terrorists attacked the Treasury Department.
Data can also be restored, but that would be a lot harder since the data changes from day to day.
All the shit they put into the databases would have to be separated from the good data, and deleted data would have to be restored in a way that doesn't mess up the current state of the system.
It could take a year or more, depending on the amount of damage they are inflicting on the system.

[Climate Crusader]

3. I could very well be paranoid, but days after Musk tapped in to the federal payment system...

... I have experienced something very weird.

I usually file my fed and state taxes right away, as soon as I can. I did so this year, using a commercial e-filing system I have been satisfied with in the past. I was wondering how long it would take the clown show in DC to accept the return and issue my refund, a few hundred dollars, and remember that the Biden admin had been memorably fast.

I filed about the time Musk was accessing systems and days later, less than a week, my refund was deposited into my Credit Union. Fine, rapid response. But oddly, the deposit was made to the wrong account. Instead of going into my checking like everything does, and my taxes always have, it was deposited into my saving account. I have all deposits go into my checking and only deposit to my savings account as transfers from that account. I have never attached the savings account number to any of my filings or any paperwork of any kind. The savings acct. number is one digit off the checking account number.

It almost seems like some weird fishing maneuver somehow. Just weird.

We live in interesting times.

[dalton99a]

4. A 25-year-old avowed racist